Cases Study: Code Red. ©2002, Jedidiah R. Crandall, Susan L. Gerhart, Jan G. Hogle.  http://sfsecurity.pr.erau.edu
What does this mean?
Vulnerable systems had plenty of opportunity to be patched and weren’t
Systems administrators didn’t know there was a vulnerability?
Systems administrators didn’t know there was a patch?
Media didn’t explain that there was a vulnerability or a patch?”

“Cyber terrorism” is a real threat
One of the first things the worm did when it infected a machine was to check to see if that machine used English as the default language (If so the web page was defaced).
Probably more than 200,000 of the infected machines were in the U.S., U.K., Canada, Australia, and New Zealand.
The worm could have easily caused billions of dollars more in data loss for English-speaking-countries only.
The denial-of-service attack on the White House would probably have succeeded had the attacker used the URL instead of the IP address.